CVE-2018-11771

Publication date 16 August 2018

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.

Status

Package Ubuntu Release Status
libcommons-compress-java 24.10 oracular
Fixed 1.18-1
24.04 LTS noble
Fixed 1.18-1
23.10 mantic
Fixed 1.18-1
23.04 lunar
Fixed 1.18-1
22.10 kinetic
Fixed 1.18-1
22.04 LTS jammy
Fixed 1.18-1
21.10 impish
Fixed 1.18-1
21.04 hirsute
Fixed 1.18-1
20.10 groovy
Fixed 1.18-1
20.04 LTS focal
Fixed 1.18-1
19.10 eoan
Fixed 1.18-1
19.04 disco
Fixed 1.18-1
18.10 cosmic
Fixed 1.18-1
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable
14.04 LTS trusty Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libcommons-compress-java

Severity score breakdown

Parameter Value
Base score 5.5 · Medium
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H